I have a Linux machine connected to a Windows 98 PC on port 104. Now I want to block the OS fingerprinting using nmap for the windows 98 PC. I tried using iptables (blocking that particular port) but that stops the communication altogether on the port. Is there some other solution to this so as to block only the OS fingerprinting and not the communication using nmap or any other tool?

  • OS fingerprinting usually works by looking at what a range of ports return - blocking a single port generally only prevents communication over it. Therefore, you'd want to look at what other ports are open, since nmap may be using those to identify the OS. I'm really hoping the Windows 98 PC is only used for security testing practice too... – Matthew Mar 3 '16 at 11:33
  • Actually OS fingerprinting can also be done by fingerprinting TCP options. See lcamtuf.coredump.cx/p0f3 for an example using p0f rather than nmap. – forest Apr 3 '16 at 5:49

OS fingerprinting also detects OS depending implementation specifics in network responses. A simply port block will not work. For these specific topic an application proxy with a different OS could make your Windows PC invisible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.